Defending in the Post-Mythos Era (Your Runbook)

Okay, your run book, we have established that the world has changed. Our adversaries have a significant advantage.00:08The defenders develop is real. We the good guys have to be right hundred percent of the time. With this for background, we move to our 3rd and final legenda item, active actions. The takeaway from this session is not this deck.00:17It is to come up with a one page document that your operations team can execute when things go wrong at 02:00 A.M. on a Saturday. The true run book removes the need for a committee in that heat of the moment.00:35It answers some critical questions. E.g., who reprioritizes the queue when a new advisory drops? What is the procedure for cannot patch scenarios? And who's responsible for emergency change approvals?00:53If your run book is longer than one page, it is too long. Compressed window. Let's look at a situation which many of you have lived. A threat is disclosed.01:13And mass exploitation is already happening or imminent within few hours. Meanwhile, your standard change window is two weeks out. The gap is the middle is exactly what we are closing today.01:30The two questions that separate high performing teams from the rest. 1st, what runtime protection exists on your internet facing assets right now? And second, who specifically owns the outside in prioritization?01:46When the queue needs to be reordered overnight, does your team know who has the authority to reprioritize afterwards? Can you shield update without a full maintenance window? Use the time now to identify one gap you can close in the.02:04Next two weeks.02:24That single gap becomes a line item in your own book. Clients utilizing platforms such as Cisco IQ, Catalyst Center, Nexus dashboard, et cetera, often have the environmental context in the portal before a formal ticket is even.02:27Opened. You set your advantage to close the gap while you negotiate the change window. Customer actions now, assess, eliminate.02:45Govern and automate. Access Map your estate to see reachable, contain and replace. A custom exercise is strongly recommended.03:01To prioritize based on exposure, not just the CBSS score. This is critical. Confirm your platforms like Cisco IQ Catalyst Center and such are populated to review your asset inventory especially the on prem devices.03:16Eliminate access to accurate inventory and a follow up to retire end of life assets. If a piece of hardware is unsupported, it requires an isolation plan and a firm date for refresh.03:35This is where, why the management platforms can help you in a big way via automation. Govern, this is this is about least privilege for all machines and humans.03:52Unless identified. Identity layer is your 1st line of defense. Automation. We need continuous validation and containment. Use Cisco IQ to surface.04:08Prioritized advisories, but remember, technology doesn't replace your cannot cannot patch policy. Before you leave today, put one name in each of those four columns.04:25One completed area with a real owner beats four perfect theoretical plants.04:43